PSAP key terms

A structured process that identifies assets, threats, vulnerabilities, and consequences, then estimates likelihood and impact so security controls can be prioritized and justified.

Layering independent security controls across people, process, and technology so that failure or defeat of one layer does not compromise the protected asset.

A principle granting each person or system only the access rights needed to perform assigned duties, for only as long as needed, reducing exposure from misuse or compromise.

An access model where permissions are assigned to job roles and individuals receive access by being placed in roles, simplifying administration and auditing of entitlements.

A table mapping subjects such as users or roles against objects such as doors or zones, with each cell recording the permitted actions, forming the basis for authorization rules.

The gradual accumulation of access rights as people change jobs or take on temporary duties, leaving entitlements they no longer need and increasing insider risk.

A periodic, documented reconciliation of who holds which credentials and permissions against current job need, resulting in removal or confirmation of each entitlement.

The analytical step that pairs credible threat actors and methods with known weaknesses in buildings, systems, and procedures to estimate risk and target mitigation.

Design approach using natural surveillance, natural access control, territorial reinforcement, and maintenance to reduce opportunity for crime and unauthorized entry.

A physical walkthrough and documentation of a site's perimeter, entry points, lighting, hardware, and procedures, used to identify gaps and support design recommendations.

Management-approved statements defining what must be protected, who may authorize access, and what behavior is required, giving technical controls their authority and operating rules.

The arrangement of servers, workstations, controllers, readers, and credentials, including where decisions are made and how components communicate across a facility.

Field panel that stores cardholder data and access rules locally and makes grant or deny decisions at the door, continuing to operate when the host server is unavailable.

A design in which the central server evaluates each access request, so loss of network or server connectivity prevents doors from granting access.

Continuous monitoring of the link between controllers and the host, with alarms raised when a device stops reporting, revealing cable cuts, power loss, or tampering.

A configuration linking two doors so that one must close and latch before the other can be released, commonly used to control entry into sensitive spaces.

A small enclosed space with two interlocked doors, where a person is admitted through the first door only after it closes and identity is confirmed.

A contactless card or fob holding an identifier that a reader collects over a short radio-frequency field, typically 125 kHz or 13.56 MHz.

A family of 13.56 MHz contactless smartcard products with memory sectors and, in some variants, cryptographic authentication, widely used for access control and transit.

Copying a credential's identifier or data onto another medium so the duplicate is accepted by readers, which is easier when the credential has no cryptographic challenge-response.

A protocol step where reader and credential each prove knowledge of a shared secret, so a copied identifier alone cannot produce a valid response.

Confirming that a person presenting a credential is its legitimate holder, using methods such as a PIN, biometric, photo comparison, or supervised enrollment.

A mathematical representation derived from a fingerprint, face, or iris sample, stored for comparison during matching rather than keeping the original image.

The proportion of unauthorized attempts a biometric system wrongly matches, a key tuning measure traded against the false rejection rate.

A lock configuration that remains locked when power is lost, used where life safety allows, so an outage does not open a protected opening.

A lock configuration that releases when power is lost, required on egress doors so occupants can exit during fire, outage, or system failure.

A locking device operated by electric current, such as a magnetic lock, electric strike, or electrified mortise lock, selected to suit the door and egress requirements.

A motion or presence detector that unlocks a door for someone approaching from inside, reducing reliance on mechanical egress hardware and nuisance alarms.

A sensor reporting whether a door is open or closed, used to detect held-open doors, forced entry, and to enforce interlock logic.

The ability to leave a space without a key, credential, or special knowledge, required by life safety codes and preserved by proper hardware selection.

A project document listing each opening with its number, hardware set, locking type, and related details, used to coordinate design, installation, and inspection.

Drawings and records updated to reflect installed conditions, including device addresses, cable routes, and panel locations, needed for maintenance and future expansion.

The documented process of testing installed hardware and software against design intent, verifying each door, alarm, and integration before acceptance and handover.

Formal verification, witnessed by the owner, that the installed system meets specified functions and performance, producing the record that starts warranty and maintenance obligations.

Dividing a network into isolated zones with controlled traffic between them, keeping access control devices off general business networks and limiting lateral movement after compromise.

Protecting data moving between readers, controllers, and servers using protocols such as TLS, so intercepted traffic cannot be read or altered.

Managing device software versions through authenticated, tested, and logged updates, preventing installation of malicious or incompatible code on controllers and readers.

Replacing factory-supplied usernames and passwords on devices before deployment, closing a common route for attackers to take over panels and cameras.

Continuous watch of door, duress, and system events by operators or a central station, with defined priorities, response actions, and escalation paths.

An alert generated when a door opens without a valid grant, indicating attempted or actual unauthorized entry and prompting operator verification and response.

Following an authorized person through a controlled opening without presenting a credential, defeated by turnstiles, interlocks, sensors, and staff awareness training.

Documented roles, notification steps, containment actions, and recovery procedures guiding staff when a security event such as a breach or system outage occurs.

A chronological, protected record of access events, operator actions, and configuration changes that supports investigation, accountability, and compliance review.

Model building and fire provisions governing means of egress, door hardware, and locking arrangements, which take precedence over security convenience.

Standards requiring operable hardware, reach ranges, and opening forces usable by people with disabilities, affecting hardware selection on accessible routes.

Legal and ethical duties covering notice, consent, secure storage, retention limits, and destruction of biometric data, which is sensitive personal information in many jurisdictions.

Rules specifying how long access records, video, and personal data are kept, who may view them, and how they are destroyed when no longer needed.